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UNITED STATES DISTRICT COURT 


for the 
Middle District of Florida 





United States of America 
Vv, 


Case No. 
6:17-mj-1361 


MICHAEL RON DAVID KADAR 


Defendant(s) 


CRIMINAL COMPLAINT 


I, the complainant in this case, state that the following is true to the best of my knowledge and belief. 
On or about the date(s) of _ January 4, 2017 to March 7, 2017 in the county of | Orange and elsewhere _in the 
Middle District of Florida , the defendant(s) violated: 


Code Section Offense Description 


18 U.S.C. § 875(c) Making Threatening Interstate Communications. 
18 U.S.C. § 844(e) Making Interstate Threats Related to Explosives. 


| CERTIFY THE FOREGOING TO BE A TRUE 
AND CORRECT COPY oF THE ORIGINAL, 


CLERK, UNITE TES DISTRICT COUR 
MIDDLE DISTRICT OF FLORIDA ; 






This criminal complaint is based on these facts: 


See attached affidavit incorporated by reference herein, 
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Complainant's signature 


Gregory J. Tarbert, Special Agent 


Printed name gand title 
Sworn to before me and signed in my presence. 
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. Spaulding, United States Magistrate Judge 
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City and state: Orlando, Florida Karla 
ne a = bein s 5: 


STATE OF FLORIDA . 
CASE NO.: 6:17-mj- | oly | 
COUNTY OF ORANGE 


AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT 
I, Gregory J. Tarbert, being duly sworn, depose and state the following: 
INTRODUCTION 

I, [am a Special Agent with the Federal Bureau of Investigation 
(“FBI’) and have been since 2003. I am assigned to the Tampa Division, 
Orlando Resident Agency. As a Special Agent, I have conducted and assisted 
with criminal and terrorism investi gations to include, but not limited to, actual 
and attempted bombings, electronic (email), telephonic, and mailed bomb 
threats, and electronic threats of mass shootings, hate crimes, and church 
arsons. During the course of those investigations I conducted physical 
surveillance, utilized informants, conducted consensual recordings, served 
search warrants for electronic media, served search warrants for physical 
premises, liaised with private technological companies, liaised with other law 
enforcement personnel, collected evidence, processed crime scenes, and served 
Grand Jury Subpoenas. I received training through the FBI for internet 
investigations including networks, emails, and digital evidence. I am attending 


the University of Louisville to complete a Master’s of Science in Computer 


Science. 


2: The information contained in this affidavit is based upon my 
personal knowledge and observations, interviews with persons, review of 
government and business records, and of records, reports, and information 
received from other law enforcement officers and law enforcement sources, 
This affidavit is not intended to convey all the facts of the entire investigation, 
but rather to establish probable cause to support the request for the proposed 
criminal complaint. 

3. This affidavit is made in support ofa criminal complaint and arrest 
warrant charging Michael Ron David KADAR with the following offenses, 
which are summarized in Attachment A which is hereby incorporated by 
reference: 

a. Fifteen violations of transmitting in interstate and foreign 
commerce any communication containing any threat to 
injure the person of another, in violation of 18 U.S.C. 
§ 875(c); and 

b. Thirteen violations of willfully making a threat and 
maliciously conveying false information knowing the same 
to be false concerning an attempt and alleged attempt being 
made and to be made to kill, injure and intimidate any 


individual and unlawfully to damage and destroy any 


building by means of fire and an explosive, through the use 
of the mail, telephone, telegraph, and other instrument of 
interstate and foreign commerce, and in and affecting 
interstate and foreign commerce, in violation of 18 U.S.C. 
§ 844(e); 

4. Each violation of 18 U.S.C. § 875(c) carries a maximum sentence 
of 5 years’ imprisonment, which can be imposed consecutively with other 
violations. Each violation of 18 U.S.C. § 844(e) carries a maximum sentence of 
10 years’ imprisonment, which can be imposed consecutively with other 
violations. 

3S: KADAR is a dual U.S-Israeli citizen. During the criminal acts 
described herein, he resided in Ashkelon, Israel. 

The Threat Calls 

6. Beginning on January 4, 2017, and continuing until March 7, 
2017, an individual, later identified as KADAR, made at least 245 threatening 
telephone calls involving bomb threats and active shooter threats. A significant 
portion of the threats targeted Jewish community centers (“JCCs”), and other 


historically Jewish institutions such as Jewish schools and Anti-Defamation 


League’ offices. This affidavit contains only summaries of threatening calls 
placed to locations in the Middle District of Florida, but KADAR placed similar 
threatening calls to locations throughout the United States and abroad on at 
least 15 different dates. In the calls, KADAR usually stated either that a bomb 
was located in the building, or that someone was coming to commit a mass 
shooting at the facility. Many of the calls contained graphic descriptions of 
impending violence to the facilities, and particularly to children located in the 
facilities. Many of the calls resulted in the temporary closure and evacuation or 
lockdown of the targeted facilities, and required law enforcement and 
emergency personnel to respond and clear the area. No actual explosives were 
found in relation to any of the calls. 

7. In January 2017, the FBI, the U:S. Atom: Office for the 
Middle District of Florida, the Civil Rights Division of the Department of 
Justice, and the Computer Crime and Intellectual Property Section (“CCIPS”) 
of the Department of Justice opened a nationwide investigation regarding the 
aforementioned telephonic threats, The investigation revealed that, for all of 
the calls, KADAR utilized user accounts created at a company which provided 


online call “spoofing” services (hereinafter the “Spoofing Company”). The 





' The Anti-Defamation League has regional offices across the United States. 
The mission of the Anti-Defamation League is to stop the defamation of the 
Jewish people and to secure justice and fair treatment for all. 


Spoofing Company’s services allow the user to hide a true caller identification, 
replace the caller identification information to that of the caller’s choosing, 
disguise the voice of the caller, and record the calls. Review of records obtained 
from the Spoofing Company revealed KADAR initiated all of the calls through 
the Spoofing Company’s service using multiple Google Voice accounts, which 
are internet-based voice over internet protocol (“VOIP”) accounts which allow 
the user to use the internet for telephone communications. Further, KADAR 
paid for the Spoofing Company’s service using Bitcoin, a type of semi- 
anonymous virtual currency. Additionally, KADAR used the recording service 
provided by the Spoofing Company to record each of the threatening calls. 

8, Review of records obtained from the Google Voice and Spoofing 
Company accounts revealed that the accounts were created and accessed using 
a variety of Virtual Private Networks (“VPNs”) and proxy services, which allow 
users to conceal their IP address by redirecting internet traffic through 
intermediary machines. 

9. On January 4, 2017, KADAR used the Spoofing — to 
make approximately 31 calls to facilities throughout the United States and 
abroad. All of the calls utilized the same Spoofing Company account. In each 
call, KADAR used the Spoofing Company’s voice changing function to 


disguise his voice to appear female. Some of these calls are summarized below: 


a. On January 4, 2017, at approximately 10:43 a.m.,’ 
-KADAR called Chabad? South Orlando, in Orlando, 
Florida (‘Chabad South Orlando”), which operates a 
Jewish day school and preschool. During the call, KADAR 
stated there was a bomb in the school. The call was 
disconnected, but approximately one minute later, 
KADAR called Chabad South Orlando again, and 
reiterated that there was an explosive in the school. 

b. On January 4, 2017, at approximately 10:45 a.m., KADAR 
called the Jewish Academy of Orlando, which is housed in 
the Roth JCC of Greater Orlando in Martland, Florida (the 
“Roth JCC”). The Roth JCC also houses a day care and a 
preschool. During the call, KADAR stated there was a “C- 
4 bomb” in the academy, and that they did not “have a lot 


of time left.” 


? All times in this affidavit are Eastern Standard Time. 

> A “Chabad” (or “Chabad house”) is a form of Jewish community center 
associated with the Chabad branch of Orthodox Hasidic Judaism primarily 
serving both educational and observance purposes. 


10. On January 5, 2017, KADAR used the Spoofing Company to 


make approximately 67 calls to facilities throughout the United States and 


abroad. All of the calls utilized the same Spoofing Company account. In each 


call, KADAR used the Spoofing Company’s voice changing function to 


disguise his voice to appear female. Some of these calls are summarized below: 


a. 


At approximately 11:45 am., KADAR called Chabad 
South Orlando again. Durmg the call, KADAR claimed he 
was coming to the school in five minutes with an AR-15 and 
two handguns to kill dozens of children. KADAR warned 
that he was going to shoot children in the head, and that 
there was going to be a bloodbath. 

At approximately 11:48 a.m., KADAR called the North 
Campus of the Tampa JCC Preschool in Tampa, Florida 
(“Tampa JCC Preschool North”). During the call, 
KADAR claimed to have three handguns, and stated he 
was coming to the school to kill children. KADAR stated 
he would be in the school shortly. 

At approximately 11:49 a.m., KADAR called the South 
Campus of the Tampa JCC Preschool in Tampa, Florida 


(“Tampa JCC Preschool South”). During the call, 


KADAR claimed there _— a bomb in the school, and ina 
short time, the shrapnel from the bomb would be directed 
into the heads of the Jewish children. KADAR warned that 
the shrapnel would blow off the children’s heads, and two 
dozen children would be slaughtered. KADAR claimed to 
be in a car by the school with the detonator in hand. 

At approximately 11:54 am., KADAR called the 
Maimonides Hebrew Day School in Ft. Myers, Florida. 
During the call, KADAR stated that there was a “C-4 
bomb” in the school and that, in a short time, shrapnel from 
the bomb would be directed into the heads of the Jewish 
children. KADAR further stated the shrapnel would “blow 


their heads off’ and “rip off their heads.” 


On January 9, 2017, KADAR used the Spoofing Company to 


make approximately 52 calls to facilities throughout the United States and 


abroad. All of the calls utilized the same Spoofing Company account. In each 


call, KADAR used the Spoofing Company’s voice changing function to 


disguise his voice to appear female. Some of these calls are summarized below: 


At approximately 10:50 a.m., KADAR called the Tampa 


JCC Preschool South. During the call, KADAR stated 


there was a bomb in the school, and in a short time, the 
shrapnel from the bomb would be directed at the heads of 
children. 

At approximately 10:52 a.m., KADAR called the Roth 
JCC. During the call, KADAR claimed there was a bomb 
in the “JCC.” KADAR stated the detonator was in hand 
and the explosive device would be set off if he saw law 
enforcement. KADAR stated the shrapnel would blow 
people’s heads off, and there was going to be a bloodbath in 
the “JCC of Orlando.” 

At approximately 11:02 a.m., KADAR called the Jewish 
Community Alliance in Jacksonville, Florida, which 
Operates a preschool and kindergarten. During the call, 
KADAKR stated there was a bomb inside the facility that 
would go off within the hour. KADAR stated there was 
going to be a “bloodbath in the JCA.” The person receiving 
the call asked KADAR if he put the bomb in place, and 


KADAR stated “maybe.” 


12, On January 18, 2017, KADAR used the Spoofing Company to 
make approximately 45 calls to facilities throughout the United States and 
Canada. All of the calls utilized the same Spoofing Company account. In each 
call, KADAR used the Spoofing Company’s voice changing function to 
disguise his voice to appear female. Some of these calls are summarized below: 

a. At approximately 9:56 a.m., KADAR called the Roth JCC. 
During the call, KADAR stated ie was a bomb in the 
JCC preschool. KADAR further stated that, in a short time, 
a large number of “Palestinian Jewish” children would have 
their heads blown off. 

b. At approximately 10:57 a.m., KADAR called the Sabes 
JCC in Jacksonville, Florida. The caller claimed there was 
a bomb in the school, and people were going to be killed 
when it exploded. KADAR claimed the bomb was a 
Semtex* bomb with a timer, and the bomb was hidden 
inside a bag. KADAR claimed there would be a bloodbath, 


and “Jews” were going to have their heads blown off. 


* Semtex is a type of plastic explosive. 
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13. On February 16, 2017, KADAR used the Spoofing Company to 
make approximately 25 calls to facilities throughout the United States and 
Canada. All of the calls utilized the same Spoofing Company account. In each 
call, KADAR used the Spoofing Company’s voice changing function to 
disguise his voice to appear female. Some of these calls are summarized below: 

a. At approximately 11:10 a.m., KADAR called Glenridge 
Middle School in Orlando, Florida. During the call, 
KADAR stated there was a bomb in the school. KADAR 
further stated that, in a short time, the shrapnel would rip 
off children’s heads and there would be a bloodbath in the 
school. KADAR claimed an associate was going to 
detonate the bomb. 

b. At approximately 11:35 a.m., KADAR called the Orlando 
International Airport in Orlando, Florida. pun the call, 
KADAR stated there was a bomb on a plane, specifically 
United Airlines flight 1965. KADAR further stated that it 


was a “TATP’”? bomb, and the bomb was with his associate 


> TATP is an explosive compound that has been previously used in a number of 
terrorist attacks, including the March 2016 Brussels, Belgium, attack and the 
November 2015, Paris, France attack. 


I] 


who was on the plane. KADAR claimed he helped his 
associate smuggle the bomb on the plane. 

14. On February 20, 2017, KADAR used the Spoofing Company to 
make approximately 14 calls to facilities throughout the United States and 
Canada. All of the calls utilized the same Spoofing Company account. In each 
call, KADAR used the Spoofing Company’s voice changing function to 
disguise his voice to appear female. These threats included a call made at 
approximately 11:08 a.m., to the Tampa JCC Preschool South. During the call, 
KADAR stated there was a “TATP” bomb in the school. KADAR further 
stated that, in a short time, a large number of “Jew children” were going to have 
their heads blown off from the shrapnel. KADAR further stated the bomb was 
as large as a Suitcase, and was surrounded by a few bags of shrapnel. KADAR 
claimed his associate was working on detonating the bomb and it would go off 
in about an hour. 

15. On February 27, 2017, KADAR used the Spoofing Company to 
make approximately 69 calls to facilities throughout the United States and 
Canada. All of the calls utilized one of two Spoofing Company accounts. In 
each call, KADAR used the Spoofing Company’s voice changing function to 
disguise his voice to appear female, or change his voice to a different male voice. 


These threats included a call, made at approximately 9:11 a.m., to the 
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a 


Maimonides Hebrew Day School in Ft. Myers, Florida, During the call, 
KADAR stated that there was a bomb in the school and that, in a short time, 
Jewish children were going to be slaughtered. He further stated their heads were 
going to be blown off by the shrapnel, and they did not have a lot of time left. 

16. During the investigation, agents served over 100 subpoenas and 
court orders to internet service providers, email providers, VPN services, the 
Spoofing Company, and others to identify the subject who made the calls. 

17. Records from the Spoofing Company indicated that three of the 
Spoofing Company accounts used to place threatening telephone calls were 
accessed by IP addresses in Israel. 

18. Based upon the information gathered in the investigation, agents 
linked the threats described above to a series of telephone threats investigated 
by the FBI Athens Resident Agency, the U.S. Attorney's Office for the Middle 
District of Georgia, and Israeli authorities, which had identified a particular 
neighborhood in the city of Ashkelon, Israel as the potential source of the calls. 
In each of these investigations, the subject made “swatting” calls, bomb threats 
or active shooter threats, using similar methodology described in this affidavit. 
Analysis of IP addresses connected to the threats indicated the subject was 


accessing many services with IP addresses resolving to Israel. 
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Israel Investigation and Post Arrest 


I9. Israeli authorities subsequently coordinated with the FBI 
regarding various means that the perpetrator might be accessing these IP 
addresses. In March 2017, FBI employees deployed to Israel to support Israeli 
investigators in identifying and locating the suspect. 

20. During surveillance of the previously identified neighborhood in 
Ashkelon, Israeli authorities observed a large parabolic antenna, which 
appeared to enable long-distance outdoor directional connections to wireless 
networks, physically connected to a particular apartment unit, which was later 
determined to be KADAR’s residence. 

21. Qnor about March 23, 2017, the Israeli National Police (“INP”) 
executed a search warrant at KADAR’s residence. During this operation, INP 
officers took KADAR into custody. While being taken into custody, KADAR 
spontaneously said he “did not do it.” When asked what he did not do, 
KADAR stated “the threats.” When asked what threats, he stated the “JCC 
threats.” Prior to this statement, officers had not made any mention of JCC 


threats. 
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22. The INP searched KADAR’s bedroom and identified a cable 
running from the parabolic antenna at the residence window to a network 
adapter connected to a laptop in KADAR’s bedroom. This device would have 
allowed KADAR to access open Wi-Fi networks at other, distant locations. 

23. The INP seized a laptop located in KADAR’s bedroom, along 
with a USB flash drive connected to the laptop. Forensic analysis of the flash 
drive and the laptop is still ongoing. Initial review of the USB flash drive 
revealed numerous recorded threat calls, organized by date and geographic 
location, as well as media reports covering many of those threat calls. 
Additionally, the flash drive contained news reports specific e the JCC threats 
in 2017. The USB flash drive also contained folders and files with titles about 
the Spoofing Company and recorded calls. Specifically, there was a folder titled 
“Archive of Targets” which contained a folder titled “2017.” 

24. The 2017 folder contained sub-folders for January, February, and 
March 2017. These folders contained sub-folders for the United States, Canada, 
Denmark, the United Kingdom, and other countries. These country-specific 
subfolders contained recordings of the threatening calls to Jewish institutions 
and other locations. Some of the subfolders had names such as “Bomb Threats 
to Jewish Institutions.” These folders contained recordings of many of the 


threat calls described above, along with news articles describing the law 
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enforcement and public safety responses to the threats. Agents compared a 


sample of recordings from the USB flash drive folders with the corresponding 


recordings obtained from the Spoofing Company and confirmed them as being 


identical. These recordings are not publicly available, and could only have been 


obtained by law enforcement investigators or by a person with access to the 


Spoofing Company Accounts used to make these calls. Some of these 


recordings are summarized below. 


a. 


Agents found a file in a folder titled “THE ARCHIVE OF 
TARGET’S [sic} > 2017 > January 2017 > Florida > Jewish 
Academy of Orlando.” The file was labeled with the 
telephone number for the Jewish Academy of Orlando, and 
consisted of a recording of the call received by the school on 
January 4, 2017, which is summarized above in paragraph 
9b) of this affidavit. 

Agents found a file in a folder titled “THE ARCHIVE OF 
TARGET’S {sic} > 2017 > January 2017 > United States > 
BOMB THREATS TO JEWISH INSTITUTIONS 
JANUARY 9 2017 [sic] > Recordings > Jewish 
Community Center Preschool in Tampa, FL.” The file was 


labeled with the telephone number for the Tampa JCC 
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Preschool South, and consisted of a recording of the call 
received by the school on January 9, 2017, which is 
summarized above in paragraph | (a) of this affidavit. 
Agents found a file in a folder titled “THE ARCHIVE OF 
TARGET?’S [sic] > 2017 > January 2017 > United States > 
BOMB THREATS TO JEWISH INSTITUTIONS 
JANUARY 9 2017 [sic] > Recordings > Jewish Federation 
of Greater Orlando.” The file was labeled with the 
telephone number for the Roth JCC in Maitland, FL, and 
consisted of a recording of the call received by the J CC on 
January 9, 2017, which is summarized above in paragraph 
11(b) of this affidavit. 

Agents found a file in a folder titled “THE ARCHIVE OF 
TARGET?’S [sic] > 2017 > January 2017 > United States > 
BOMB THREATS TO JEWISH INSTITUTIONS 
JANUARY 18 2017 [sic] > Recordings > The Roth Family 
Jewish Community Center of Greater Orlando.” The file 
was labeled with the telephone number for the Roth JCC, 


and consisted of a recording of the call received by the JCC 
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on January 18, 2017, which is summarized above in 
paragraph 12(a) of this affidavit; 

Agents found a file tn a folder titled “THE ARCHIVE OF 
TARGET?’S [sic] > 2017 > February 2017 > United States 
> Glenridge Middle School in Orlando, FL.” The file was 
labeled with the telephone number for Glenridge Middle 
School, and consisted of a recording of the call received by 
the school on February 16, 2017, which is summarized 
above in paragraph 1 3(a) of this affidavit. 

Agents found a file in a folder titled “THE ARCHIVE OF 
TARGET’S [sic] > Airplane Targets > Successes And Non 
Search-Diversion Incidents > 2017 > United Airlines Flight 
1965 Orlando to Orlando — February 16 2017,” The file was 
labeled with the telephone number for Orlando 
International Airport, and consisted of a recording of the 
call received by the airport on February 16, 2017, which is 
summarized above in paragraph 13(b) of this affidavit. 

A file located in a folder labelled “THE ARCHIVE OF 
TARGET’S [sic] > 2017 > February 2017 > United States 


> BOMB THREATS TO JEWISH INSTITUTIONS 
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February 20 2017 [sic] > RECORDINGS [sic] > Jewish 
Community Center Preschool in Tampa, FL.” The file was 
labeled with the telephone number of the Tampa JCC 
Preschool South, and consisted of a recording of the call 
received by the school on February 20, 2017, which is 
summarized above in paragraph 14 of this affidavit. 

h. A file located in a folder labelled “THE ARCHIVE OF 
TARGET’S [sic] > 2017 > February 2017 > United States 
> BOMB THREATS TO JEWISH INSTITUTIONS FEB 
27 2017 [sic] > Recordings Moming > Maimonides Hebrew 
Day School in Fort Myers, FL.” The file was labeled with 
the telephone number for Maimonides Hebrew Day 
School, and consisted of a recording of the call iéeeived by 
the school on February 27, 2017, which is summarized 
above in paragraph 15 of this affidavit. 

25. Aside from the threat calls themselves, several items related to the 
calls were located on the USB flash drive, including the following: 

a. Agents discovered a text file containing the phone number 
(510) 974-3794, the words “job ioo,” and email address 


Haymanestateattime29[@]gmail.com. The file itself was 
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titled with the name of the Spoofing Company. These were 
the Google Voice number, name and email associated with 
the Spoofing Company account used to make threatening 
calls on February 22 and 23, 2017. 

Agents discovered a file titled “voice.txt” which contained 
email addresses guelph5880[@]lgmail.com and 
oranxn430[@]yahoo.co.uk and phone number (510) 974- 
3794. According to Google records, these were the email 
addresses associated with the Google Voice number used to 
make threatening calls through the Spoofing Company on 
February 22 and 23, 2017. 

Agents discovered a file titled “list of targets feb 22.txt” 
which was a list of several Jewish schools and facilities 
along with their telephone numbers. As an example, the 
first six entries on the list were: (1) the Anti-Defamation 
League office in New York, New York; (2) the Lerner 
Jewish Community Day School in Durham, North 
Carolina; (3) the Charlotte Jewish Day Schoo] in Charlotte, 
North Carolina; (4) the New Orleans JCC in New Orleans, 


Louisiana; (5) Anti-Defamation League office in 
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Washington D.C.; and (6) Beit Rabban Day Schooi in New 
York, New York. According to Spoofing Company records, 
en the six locations and phone numbers called on 
February 22 and 23, 2017 by the account with identifiers 
(510) 974-3794, the name “job ioo,” and email address 
Haymanestateattime29[@]egmail.com. 

Agents discovered a text file containing the phone number 
(317) 983-4854 and email address 
creditturnerrrz[@|yahoo.com. The file title included the 
name of the Spoofing Company. According to Spoofing 
Company records, these were the Googie Voice number, 
name and email address used to create an account used to 
make threatening calls during the afternoon hours of 
February 27, 2017; 

Agents discovered a text file containing email address 
prefessional3636[@|hotmail.com, name “greg howyard,” 
and phone number (702) 983-3894. It also contained a line 
“Bitcoin Address Bits sent to: 
IPGCMeFSZnjZPpm4dvVQojYLWNanJuto9U.” 


According to Spoofing Company recotds, these are the 
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exact email address, name, Google Voice number, and the 
specific Bitcoin wallet address paid to utilize the Spoofing 
Company account to make threatening calls during the 
morming hours of February 27, 2017. The file itself was 
titled with the name of the Spoofing Company and a 
reference to February 27. 

Agents discovered a file titled “feb 27 google voice.txt” 
contained email addresses phillipsburgbbd7[@]gmail.com 
and jarektol45(@]yahoo.com, along with phone number 
(702) 983-3894. According to records from Google, these 
were the email addresses associated with the Google Voice 
number used to make threatening calls Sndcinais the 
Spoofing Company during morning hours of February 27, 
2017. The file also contained email addresses 
sanjoserlv9[(@|gmail.com | and 
fabiandh641[@]hotmail.com on the same plain text line as 
(317) 983-4854, which was the number used to place calls 
through the Spoofing Company during the evening hours of 


February 27, 2017. 
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Agents discovered a file titled “list of Jewish day 
schools.txt” which was a list of several Jewish schools and 
facilities along with their telephone numbers. As an 
example, the first six entries were: (1) Jewish Children’s 
Museum in Brooklyn, New York, (2) Intown Jewish 
Preschool in Atlanta, Georgia; (3) N.E. Miles Jewish Day 
School in Birmingham, Alabama; (4) JCC on the Hudson 
in Tarrytown, New York, (5) David Posnack Jewish Day 
School in Davie, Florida; and (6) Maimonides Heberew 
Day School in Fort Myers, Florida. According to Spoofing 
Company records, these were six locations and phone 
numbers called on February 27, 2017 by the account with 
identifiers prefessional3636[@]hotmail.com, name “greg 
howyard,” and phone number (702) 983-3894. According 
to call records from the Spoofing Company, oe Jewish 
Preschool, N.E. Miles Jewish Day School, JCC on the 
‘Hudson, David Posnack Jewish Day School, and 
Maimonides Hebrew Day School were called in the exact 
same order as they were listed in this file contained on 


KADAR’s flash drive in this file. 
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Agents found a file titled ‘“Blockchain.info MAIN 
ACCOUNT txt.” which contained a Bitcoin wallet address 
and private key® used to pay for the Spoofing Company 
account used to make threats on January 3, 4, and 5, 2017. 
Agents located a separate Bitcoin wallet address in a file 
titled “Address 2 for calls. Address: 
1Eu2ZaXiBp7mr2kS9poSseCVqPufQmbaHM.” This 
wallet address was used to pay for the Spoofing Company 
account used to make similar threats outside the Middle 


District of Florida on March 7, 2017. 


Prior to the arrest of KADAR, agents obtained the recordings of 


_ the threat calls. With the assistance of the Spoofing Company, FBI personnel 


removed the modulation used by the Spoofing Company’s software to disguise 


KADAR's voice. 


The unmodulated recordings of the threat caller’s voice 


revealed a distinct and pronounced speech impediment. Investigators who 


interacted with KADAR post-arrest matched the recording of the caller’s voice 


to that of KADAR, who possesses the same distinctive speech impediment. 


° A Bitcoin wallet address is a public identifier of an individual’s Bitcoin 
wallet, similar to a bank routing number. The private key is a digital 
signature, held by the account holder, which allows the wallet holder to access 
the Bitcoin wallet, similar to a bank account password or PIN. 
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27. Based on the above, your affiant respectfully submits that probable 
cause exists to. believe that Michael Ron David KADAR has committed 
violations of 18 U.S.C. §§ 844(e) and 875(c). 


28. This concludes my affidavit. 





Gregory J, Tarbert 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn before me 
Gt day, of on 2017. 








Sari R Midd he 
United States Magistrate Judge 
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ATTACHMENT A 






DATE VIOLATIONS) | ~—- VICTIM LOCATION 


January 4, 2017 Sections 875(c) and 844(e) Chabad South Orlando 






January 4, 2017 Sections 875(c} and 844(e) Jewish Academy of Orlando/ 
Roth JCC (Maitland) 


January 5, 2017 Section 87 5(c) Chabad South Orlando 
January 5, 2017 | Section 875(c) Tampa JCC Preschool North 
January 5, 2017 Sections 875(c) and 844(e) Tampa JCC Preschool South 









January 5, 2017 Sections 875(c) and 844(e) Maimonides Hebrew Day School 
(Ft, Myers) 


January 9,2017 | Sections 875(c) and 844{e) Tampa JCC Preschool South 

January 9, 2017 Sections 875(c} and 844(e) Roth JCC 

Sections 875(c) and 844(e} Jewish Community Alliance of | 
| Jacksonville 


January 18, 2017 sections 875(c} and 844(e) Roth JCC 
January 18, 2017 Sections 875(c) and 844(e) Sabes JCC Wacksonville} 


February 16, 2017 Sections 875(c) and 844(e) Glenridge Middle School | 


(Orlando) 
| February 16,2017 | Sections 875(c) and 844e) Orlando International Airport 


February 20, 2017 Sections 875(c) and 844(e) Tampa JCC Preschool South 


| February 27,2017 | Sections 875(c) and 844(e) Maimonides Hebrew Day School 
(Ft. Myers} 











January 9, 2017 























AO 442 (Rev. | I/11) Arrest Warrant 


UNITED STATES DISTRICT COURT 


for the 


Middle District of Florida 


United States of America 





Vv. ) . 
) r 
) | CERTIFY THE FOREGOING TO BE A TRUE 
AND GORRECT COP¥OF THE ORIGINAL, 
CLERK, UNITED S S DISTRICT COURT 
MICHAEL RON DAVID KADAR , eer pte aap res 
Defendant 
By: DEPUTY CLERK 
ARREST WARRANT oat 
To: Any authorized law enforcement officer 


YOU ARE COMMANDED to arrest and bring before a United States magistrate judge without unnecessary delay 


(name of person to be arrested) MICHAEL RON DAVID KADAR 
who is accused of an offense or violation based on the following document filed with the court: 


J 


Indictment O Superseding Indictment © Information O Superseding Information ( Complaint 


Probation Violation Petition (J Supervised Release Violation Petition 0 Violation Notice © Order of the Court 
This offense is briefly described as follows: 


Making Threatening Interstate Communications in violation of 18 U.S.C. § 875(c) and Making Interstate Threats Related to 
Explosives in violation of 18 U.S.C. § 844(e). 


Date: 4 v2 





City and state: _ Orlando, Florida Karla R. Spaulding, United States Magistrate Judge 


Printed name and title 


Return 


This warrant was received on (date) , and the person was arrested on (date) 
at (city and state) 


Date: 


Arresting officer’s signature 


Printed name and title 





